Privacy Policy

Hotezz is a professional digital platform for the hospitality industry. It enables hospitality professionals, hotel operators, suppliers and other industry participants to discover hospitality projects, share professional knowledge and inspiration, connect with relevant businesses and professionals, and collaborate on hospitality projects.

As Hotezz develops, additional functionality may include supplier discovery, product information and hospitality procurement workflows.

This Privacy Policy applies to the Hotezz platform and to the Hotezz websites at hotezz.com, hotezz.ch, hotezz.fr and hotezz.eu, and any successor or additional domains operated by Hotezz.

It explains how Hotezz collects, uses, stores and otherwise processes personal data when you:

• visit a Hotezz website;
• create or use a Hotezz account;
• create or maintain a professional profile;
• participate in projects;
• submit, view or interact with platform content;
• use supported third-party authentication or integrations;
• communicate with Hotezz; or
• otherwise use Hotezz services.

Hotezz processes personal data in accordance with applicable data protection law, including the Swiss Federal Act on Data Protection (“FADP” / nLPD) and, where applicable, the European Union General Data Protection Regulation (“GDPR”).

This Privacy Policy should be read together with the Hotezz Terms of Use, the Hotezz Platform Participation Charter and, for suppliers, the Hotezz Supplier Admission Policy.

The person responsible for the processing of personal data through Hotezz is:

Hotezz is currently operated by Christopher Rudolph as a natural person, prior to incorporation of the intended Hotezz corporate entity.

On incorporation, responsibility for operating Hotezz and for the processing of personal data described here is intended to transfer to that entity, and personal data held by Hotezz will transfer with it. This Privacy Policy will be updated accordingly and, where required by applicable law, users will be notified.

The personal data processed by Hotezz depends on how you use the platform.

When you access Hotezz, certain technical information may be processed automatically, including:

• IP address;
• browser and device information;
• operating system;
• date and time of access;
• session information;
• authentication and authorisation events;
• application and security logs;
• information necessary for troubleshooting, platform security and reliability.

Hotezz may also process information about how platform functionality is used where necessary to operate, secure and improve the service.

Providing the Hotezz platform — to create and manage user accounts; authenticate users; manage sessions; manage roles, organisation relationships and permissions; provide authorised access to platform functionality; maintain professional profiles; and enable project participation and collaboration.

Professional discovery and collaboration — to enable hospitality professionals to discover and interact with relevant projects, organisations, suppliers, products, professionals, expertise and professional content.

Managing hospitality projects and content — to allow authorised users to create, contribute to, review, manage, submit and publish hospitality projects and related content.

Procurement functionality — where such functionality is made available, to support product requirements and specifications, supplier discovery, requests for quotation, supplier quotations, internal approvals, and procurement-related communications and records.

Third-party integrations — to provide authentication or other integrations selected by users.

Security and platform integrity — to authenticate users; enforce permissions; prevent unauthorised access; detect misuse or fraudulent activity; investigate security incidents; maintain appropriate security and audit records; and protect Hotezz, its users and participating organisations.

Communications — to provide account and security notifications, service-related communications, responses to enquiries, and notice of important changes affecting Hotezz. These are necessary to operate your account and cannot be opted out of while your account remains open.

Separately, Hotezz may send platform news, professional content or information about Hotezz services. Where consent is required — including under Article 3(1)(o) of the Swiss Unfair Competition Act and applicable EU rules — Hotezz will obtain it before sending. Every such message will include a working unsubscribe mechanism, and you may object to direct marketing at any time at no cost.

Improving Hotezz — to understand how Hotezz is used and improve its functionality, performance, reliability, security and user experience. Where reasonably possible, Hotezz uses aggregated or anonymised information for analytical purposes that do not require identification of individual users.

Legal and regulatory purposes — to comply with applicable laws, lawful requests and legal obligations, and to establish, exercise or defend legal claims.

Where the GDPR applies, Hotezz relies on the following legal bases:

Where Hotezz relies on legitimate interests, those interests are operating, securing and improving Hotezz and providing a professional hospitality platform. You may object to processing based on legitimate interests as described in section 15.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing lawfully undertaken before consent was withdrawn.

Under the FADP, processing does not generally require a legal basis of this kind, but is subject to the principles of lawfulness, good faith, proportionality, purpose limitation, accuracy and security.

Hotezz's core platform infrastructure is hosted on a Virtual Private Server provided by Infomaniak Network SA, Switzerland, and core hosted platform data is stored in infrastructure located in Switzerland.

Authentication is operated within the Hotezz-hosted environment using self-hosted software; Hotezz does not use an external hosted authentication service, and no such service receives your credentials by virtue of Hotezz's choice of software.

Hotezz applies technical access-control mechanisms at both the application and database layers, including relationship-based authorisation and row-level access restrictions, to limit access according to factors such as user identity, organisation, role, relationships and permissions.

Hotezz does not sell personal data.

Personal data may be disclosed or made accessible where reasonably necessary to operate Hotezz.

Other Hotezz users — information may be visible to other users where this is inherent in the functionality you use and permitted by applicable visibility and access rules. For example, professional profile information, project participation or contributions to a published hospitality project may be visible to other authorised users or, where expressly published, to visitors.

Organisations represented on Hotezz — where you use Hotezz on behalf of a hotel, hotel group, supplier or other organisation, authorised users associated with that organisation may have access to information relating to your professional role and relevant platform activities.

Hosting and infrastructure providers — Hotezz currently uses Infomaniak Network SA for VPS hosting and associated infrastructure.

Other service providers — Hotezz may use service providers for functions such as communications, security, maintenance, technical support or other services necessary to operate the platform. Such providers process only the information reasonably necessary to provide the relevant service, act on Hotezz's instructions, and are bound by written data processing agreements. A current list of service providers processing personal data on Hotezz's behalf is available on request.

Third-party integrations — where you voluntarily connect Hotezz with another service, information necessary to provide that integration may be exchanged with the relevant provider.

Corporate transactions — if Hotezz is incorporated, restructured, merged, acquired, or if all or part of its business or assets is transferred, personal data may be transferred to the relevant entity as part of that transaction, subject to this Privacy Policy and applicable law.

Legal requirements — Hotezz may disclose personal data where required by applicable law, a valid legal process, or where reasonably necessary to establish, exercise or defend legal rights.

Hotezz may maintain an official presence on LinkedIn and may integrate supported LinkedIn functionality with the Hotezz platform. This may include:

• supported account or professional-identity functionality;
• directing users between Hotezz and its LinkedIn presence;
• publishing or sharing authorised Hotezz content through the Hotezz LinkedIn page;
• publishing selected Completed Projects or related professional content where the applicable Hotezz publication and visibility permissions allow this.

Where you choose to use a LinkedIn integration, information may be exchanged between Hotezz and LinkedIn to the extent necessary to provide the functionality you request and according to the permissions presented to you.

LinkedIn independently processes personal data relating to use of its services according to its own privacy policy. Where Hotezz and LinkedIn jointly determine the purposes and means of processing in connection with the Hotezz LinkedIn page, they do so as joint controllers under the arrangement LinkedIn makes available for page administrators.

Access to or connection with a user's LinkedIn account does not itself constitute permission for Hotezz to publish personal, organisational or project information. Publication of project content through Hotezz's LinkedIn presence remains subject to applicable Hotezz content, visibility and publication permissions.

Hotezz's core hosted platform infrastructure is located in Switzerland.

Some third-party services or integrations used or selected in connection with Hotezz process personal data outside Switzerland. At present these are:

• LinkedIn — where you use LinkedIn authentication or integrations, or interact with the Hotezz LinkedIn presence. LinkedIn processes data in Ireland and the United States.

Where Hotezz discloses personal data internationally, it applies the measures required by applicable data protection law. Depending on the country and circumstances, these may include recognition of an adequate level of data protection under the Swiss and EU adequacy lists, the EU Standard Contractual Clauses as recognised by the FDPIC for Swiss transfers, the Swiss–US and EU–US Data Privacy Frameworks, or another legally permitted transfer mechanism. A copy of the relevant safeguards is available on request.

Hotezz retains personal data only for as long as reasonably necessary for the purposes for which it was collected. The periods below are indicative and subject to confirmation before publication.

Retention periods may vary according to the type of information, the relevant functionality and applicable legal or contractual requirements. When personal data is no longer required, Hotezz will delete, anonymise or otherwise handle it in accordance with applicable law.

Certain records may need to be retained following account closure where required for legal, contractual, security, audit or legitimate record-keeping purposes.

If Hotezz introduces analytics, advertising or other non-essential tracking technologies, this Privacy Policy and the applicable consent mechanisms will be updated first. Where applicable law requires consent for non-essential cookies or similar technologies, Hotezz will request that consent before using them and will provide an equally accessible means of refusing and of withdrawing consent later.

Hotezz uses technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, disclosure or destruction. Depending on the relevant processing activity, these measures may include:

• secure authentication;
• role- and relationship-based authorisation;
• database-level access restrictions, including row-level security;
• restricted administrative access;
• encryption of data in transit and at rest;
• access and security logging;
• infrastructure security;
• backup and recovery measures.

Access to information follows the principle of least privilege: users and systems receive only the access necessary for their authorised purpose.

No internet-based system can guarantee absolute security.

Hotezz maintains procedures for detecting, investigating and responding to personal data breaches.

Where a breach is likely to result in a high risk to the personality or fundamental rights of affected individuals, Hotezz will notify the Federal Data Protection and Information Commissioner as soon as possible in accordance with the FADP. Where the GDPR applies, Hotezz will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, and will inform affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

Depending on the law applicable to you, you may have the right to:

• obtain information concerning the processing of your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion where applicable;
• object to certain processing, including processing based on legitimate interests, and to object to direct marketing at any time;
• request restriction of processing where applicable;
• withdraw consent where processing relies on consent;
• request data portability where applicable.

To exercise an applicable right, contact privacy@hotezz.com.

Hotezz will respond within 30 days under the FADP and within one month under the GDPR, extendable by two further months for complex requests, in which case you will be informed. Exercising your rights is free of charge; a reasonable fee may be charged only where a request is manifestly unfounded or excessive, as permitted by law.

Hotezz may need to verify your identity before fulfilling a request, in order to prevent unauthorised access to, disclosure of or modification of personal data.

You may also lodge a complaint with a competent supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU or EEA, you may complain to the supervisory authority of your member state of residence, place of work or of the alleged infringement.

Hotezz may in the future introduce automated or AI-assisted functionality to support professional activities such as product discovery, supplier matching, recommendations, specification analysis or procurement comparison.

Hotezz does not currently carry out automated individual decision-making producing legal or similarly significant effects. Where such functionality is introduced, Hotezz will update this Privacy Policy first and will provide the information required by applicable law, including meaningful information about the logic involved and the right to obtain human intervention, express a point of view and contest the decision.

Automated recommendations or decision-support tools will not be presented as authoritative human decisions where they are not.

Hotezz is a professional B2B hospitality platform intended solely for use by professionals aged 18 or over, acting in a professional capacity. Hotezz does not knowingly collect personal data from children. If Hotezz becomes aware that it holds personal data relating to a child, it will delete that data without undue delay.

Hotezz may update this Privacy Policy as the platform, its functionality, service providers, integrations, business structure or applicable legal requirements evolve.

The current version will be published through Hotezz together with a version number and the date of the latest update. Where required by applicable law, users will receive additional notice of material changes in advance of their taking effect.

For questions concerning this Privacy Policy, Hotezz's processing of personal data or the exercise of applicable data-protection rights: